Monitoring Unauthorized Modifications to Unix Shell Configuration Files

This detection focuses on unauthorized access or modifications to critical Unix shell configuration files, including but not limited to .bashrc, .profile, and files within /etc/profile.d/. These files are responsible for defining the user environment and executing commands upon session initialization. Adversaries frequently target these scripts to achieve persistence, execute malicious payloads automatically when a user logs in, or escalate privileges by injecting code into scripts executed by privileged accounts.

The analytic identifies this activity by monitoring Linux Auditd logs specifically for path and current working directory events that reference shell initialization scripts. Because administrators and deployment tools also interact with these files for legitimate automation, the detection logic relies on auditd's ability to provide process and user context, allowing security teams to differentiate between authorized maintenance and malicious tampering. This monitoring is essential for uncovering "living-off-the-land" techniques where legitimate system tools are repurposed for persistent access.

Impact

Successful manipulation of shell configuration files provides attackers with a reliable, long-term foothold on compromised Linux hosts. If left undetected, this technique allows for the consistent execution of malicious code, the potential for lateral movement, and the silent exfiltration of data by capturing environment variables or intercepting user activity at every login.

Recommendation

1. Enable and configure auditd to capture PATH, CWD, SYSCALL, EXECVE, and PROCTITLE events to provide the necessary telemetry for identifying processes modifying sensitive configuration files.
2. Implement the provided Auditd monitoring logic in your SIEM to flag modifications to files listed in the matched_paths regex, including all user-specific home directory shell profiles.
3. Correlate detection events with EXECVE or PROCTITLE logs to identify the specific process or user responsible for the modification.
4. Establish a baseline for authorized configuration management (e.g., Ansible, Puppet) to filter out legitimate automation activities and reduce false positives.